Changeset 50114 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

Timestamp:

01/31/2021 07:02:30 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Introduce fine grained capabilities.

Previously, all permission checks for using app passwords were implemented using edit_user. This commit introduces a series of more fine grained meta capabilities that should be used instead: create_app_password, list_app_passwords, read_app_password, edit_app_password, delete_app_password and delete_app_passwords. These capabilities all map to edit_user by default, but may now be customized by developers.

Props johnbillion, TimothyBlynJacobs.
Fixes #51703.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (modified) (8 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

@@ -111 +111 @@
      */
     public function get_items_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'list_app_passwords', $user->ID ) ) {
+            return new WP_Error(
+                'rest_cannot_list_application_passwords',
+                __( 'Sorry, you are not allowed to list application passwords for this user.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -150 +164 @@
      */
     public function get_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'read_app_password', $user->ID, $request['uuid'] ) ) {
+            return new WP_Error(
+                'rest_cannot_read_application_password',
+                __( 'Sorry, you are not allowed to read this application password.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -180 +208 @@
      */
     public function create_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'create_app_password', $user->ID ) ) {
+            return new WP_Error(
+                'rest_cannot_create_application_passwords',
+                __( 'Sorry, you are not allowed to create application passwords for this user.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -249 +291 @@
      */
     public function update_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'edit_app_password', $user->ID, $request['uuid'] ) ) {
+            return new WP_Error(
+                'rest_cannot_edit_application_password',
+                __( 'Sorry, you are not allowed to edit this application password.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -309 +365 @@
      */
     public function delete_items_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'delete_app_passwords', $user->ID ) ) {
+            return new WP_Error(
+                'rest_cannot_delete_application_passwords',
+                __( 'Sorry, you are not allowed to delete application passwords for this user.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -350 +420 @@
      */
     public function delete_item_permissions_check( $request ) {
-        return $this->do_permissions_check( $request );
+        $user = $this->get_user( $request );
+
+        if ( is_wp_error( $user ) ) {
+            return $user;
+        }
+
+        if ( ! current_user_can( 'delete_app_password', $user->ID, $request['uuid'] ) ) {
+            return new WP_Error(
+                'rest_cannot_delete_application_password',
+                __( 'Sorry, you are not allowed to delete this application password.' ),
+                array( 'status' => rest_authorization_required_code() )
+            );
+        }
+
+        return true;
     }
 
@@ -458 +542 @@
      *
      * @since 5.6.0
+     * @deprecated 5.7.0 Use `edit_user` directly or one of the specific meta capabilities introduced in 5.7.0.
      *
      * @param WP_REST_Request $request
@@ -463 +548 @@
      */
     protected function do_permissions_check( $request ) {
+        _deprecated_function( __METHOD__, '5.7.0' );
+
         $user = $this->get_user( $request );